8.6High

CVE-2024-9496Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installer

silabs.com USBXpress Dev Kit Published: 2025-01-24 17:38 (1 year ago)

Description

DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Weakness (CWE): CWE-427

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
silabs.com	USBXpress Dev Kit	≤ 3.5.1

References and patches

https://community.silabs.com/068Vm00000JUQwd vendor-advisorypermissions-required

CVSS score

8.6High

Source: Silabs · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: None
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	8.6High
product-security@silabs.com	CVSS 3.1	8.6High

EPSS (chance of exploitation in 30 days)

0.24%

higher than 15% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2024-10-03
Published2025-01-24 17:38
Reached IP-DB2026-10-24 23:56
Last updated2026-06-17 11:24

Assigned by (CNA): Silabs
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time